Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jumora
Stats
Member since
11-30-2004
576
Posts
277
Helpful
84
Solutions
07-08-2014
11:46 AM
Show tech, IP addresses involved, logs and troubleshooting done are needed.
... View more
07-03-2014
12:02 PM
I know that this is an old post but then again I was looking for something else and crossed this conversation about portfast. You can actually enable this also against ASA firewalls that have sub interface configuration against a trunk port on a switch, specially when you have ASA failover.
... View more
06-19-2014
02:43 PM
Here is the configuration that you need: access-list ssh_557 permit tcp host 10.0.0.9 eq 22 any access-list ssh_7111 permit tcp host 10.0.0.9 eq 22 any static (inside,outside) tcp 65.65.65.100 557 access-list ssh_557 static (inside,outside) tcp 65.65.65.100 7111 access-list ssh_7111 ciscoasa(config)# show xlate detail 2 in use, 2 most used Flags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - static TCP PAT from inside:10.0.0.9/22 to outside(ssh_557):65.65.65.100/557 flags sr TCP PAT from inside:10.0.0.9/22 to outside(ssh_7111):65.65.65.100/7111 flags sr
... View more
06-19-2014
01:24 PM
The security appliance lets you assign a different MAC address in each context to the same shared interface, whether it is a shared physical interface or a shared subinterface. By default, shared interfaces do not have unique MAC addresses; the interface uses the physical interface burned-in MAC address in every context. An upstream router cannot route directly to a context without unique MAC addresses. You can set the MAC addresses manually when you configure each interface (see the "Configuring Interface Parameters" section), or you can automatically generate MAC addresses (see the "Automatically Assigning MAC Addresses to Context Interfaces" section). In system context configuration mode: enable config t mac-address auto
... View more
06-19-2014
12:49 PM
I also work at TAC so if you want we can webex but this could be related to the device in front of the ASA that is probably doing the NAT.
FYI: You have the PAT NAT statement above the NAT exemption for your VPN related traffic so you need to remove:
nat (inside,outside) source dynamic any interface
and then add it back so it ends on line 2.
Juan Mora
Security Technical Lead
Email: jumora@Cisco.com
Desk:770-702-6300 Ext: 4863
... View more
Please go ahead and remove this NAT statement and then place it back in:
nat (inside,outside) source dynamic any interface
... View more
06-19-2014
11:03 AM
Post the configuration. This could be because of a NAT or as indicated an ICMP command.
... View more
05-27-2014
09:13 AM
Yes, and I believe that you can install it on a windows server or there is an appliance from websense but you would need to talk to them for details.
... View more
05-26-2014
09:24 AM
What do you mean by that question: Do i need to prepare separate machine as a websense server? The question is related to websense requirements I believe that there are several options, you get a server or you buy the appliance. For further details please ask websense vendor.
... View more
05-23-2014
09:46 AM
enable
config t
policy-map global_policy
class inspection_default
inspect icmp
inspect icmp error
ASA/PIX/FWSM: Handling ICMP Pings and Traceroute
http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/15246-31.html
... View more
05-22-2014
03:53 PM
Websense is a third party product that works in conjunction with the ASA so you need to purchase it. 2. The ASA has an option with the websense (url-filtering) configuration to block proxy but now in days people use all type of proxies so you might need to monitor your network connections or block any unknown port to go out through the firewall. The ASA URL filtering document, you will find the proxy-block option: http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/97277-pix-asa-url-filtering.html#task3 Each function has some sort of impact, will it be positive or negative, I've seen a lot of ASA configured with websense without any problems if that is what you are asking.
... View more
05-22-2014
03:12 PM
email me your number at jumora@cisco.com or juanmh84@hotmail.com and we can talk things through and maybe help you out with the configuration.
... View more
05-19-2014
11:39 AM
you can clear them with "clear configure access-list <acl_name>" Please rate the assistance and mark the ticket as solved or answered.
... View more
07-03-2014
I know that this is an old post but then again I was looking for
something else and crossed this con...
06-19-2014
Here is the configuration that you need: access-list ssh_557 permit tcp
host 10.0.0.9 eq 22 anyacces...
06-19-2014
The security appliance lets you assign a different MAC address in each
context to the same shared in...
06-19-2014
I also work at TAC so if you want we can webex but this could be related
to the device in front of t...
06-19-2014
Please go ahead and remove this NAT statement and then place it back in:
nat (inside,outside) source...
05-27-2014
Yes, and I believe that you can install it on a windows server or there
is an appliance from websens...
05-26-2014
What do you mean by that question:Do i need to prepare separate machine
as a websense server?The que...
05-23-2014
enable config t policy-map global_policy class inspection_default
inspect icmp inspect icmp error AS...
05-22-2014
Websense is a third party product that works in conjunction with the ASA
so you need to purchase it....
05-22-2014
email me your number at jumora@cisco.com or juanmh84@hotmail.com and we
can talk things through and ...
Public Statistics
| Date Registered | 11-30-2004 04:58 PM |
| Date Last Visited | 08-18-2017 04:00 AM |
| Total Messages Posted | 576 |
| Total Helpful Votes Received | 277 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 15 | |
| 15 | |
| 5 | |
| 5 | |
| 5 |
